|
 |
4b2fc1 |
From 858069eb28f440d5fb8658f1c3903e078ac42b92 Mon Sep 17 00:00:00 2001
|
|
|
4b2fc1 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
4b2fc1 |
Date: Fri, 12 May 2017 18:33:23 +0200
|
|
|
4b2fc1 |
Subject: [PATCH] evaluate: Avoid undefined behaviour in concat_subtype_id()
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1360789
|
|
|
4b2fc1 |
Upstream Status: nftables commit 83e52f7a7f5ea
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
commit 83e52f7a7f5eaa893e146d23ff2e9292179f9485
|
|
|
4b2fc1 |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
4b2fc1 |
Date: Tue Aug 30 19:39:52 2016 +0200
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
evaluate: Avoid undefined behaviour in concat_subtype_id()
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
For the left side of a concat expression, dtype is NULL and therefore
|
|
|
4b2fc1 |
off is 0. In that case the code expects to get a datatype of
|
|
|
4b2fc1 |
TYPE_INVALID, but this is fragile as the output of concat_subtype_id()
|
|
|
4b2fc1 |
is undefined for n > 32 / TYPE_BITS.
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
To fix this, call datatype_lookup() directly passing the expected
|
|
|
4b2fc1 |
TYPE_INVALID as argument if off is 0.
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
4b2fc1 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
4b2fc1 |
---
|
|
|
4b2fc1 |
src/evaluate.c | 5 ++++-
|
|
|
4b2fc1 |
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
diff --git a/src/evaluate.c b/src/evaluate.c
|
|
|
4b2fc1 |
index 680eda0..20584b7 100644
|
|
|
4b2fc1 |
--- a/src/evaluate.c
|
|
|
4b2fc1 |
+++ b/src/evaluate.c
|
|
|
4b2fc1 |
@@ -965,7 +965,10 @@ static int expr_evaluate_concat(struct eval_ctx *ctx, struct expr **expr)
|
|
|
4b2fc1 |
"expressions",
|
|
|
4b2fc1 |
i->dtype->name);
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
- tmp = concat_subtype_lookup(type, --off);
|
|
|
4b2fc1 |
+ if (dtype == NULL)
|
|
|
4b2fc1 |
+ tmp = datatype_lookup(TYPE_INVALID);
|
|
|
4b2fc1 |
+ else
|
|
|
4b2fc1 |
+ tmp = concat_subtype_lookup(type, --off);
|
|
|
4b2fc1 |
expr_set_context(&ctx->ectx, tmp, tmp->size);
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
if (list_member_evaluate(ctx, &i) < 0)
|
|
|
4b2fc1 |
--
|
|
|
4b2fc1 |
1.8.3.1
|
|
|
4b2fc1 |
|